Site announcement

We are switching off article comments on this website. Read about the upcoming changes to Atlassian Documentation.

Documentation for Confluence 5.7.
Documentation for Confluence Cloud and earlier versions of Confluence is available too.

Skip to end of metadata
Go to start of metadata

The People Directory provides a list of all users in your Confluence system.

If you need to disable the People Directory set the following system properties on your application server command line:

 -Dconfluence.disable.peopledirectory.anonymous=true
  • To disable the People Directory entirely:
-Dconfluence.disable.peopledirectory.all=true

(warning) The information on this page does not apply to Confluence Cloud.

This workaround will prevent the People directory from appearing on the dashboard, but if you navigate to the profile of a user, and then click on the "People" in the breadcrumb link (Dashboard >> People >> FullName >> Profile) or you go to the URL directly <CONFLUENCE_INSTALL>/browsepeople.action, you will be able to access the people directory.

To workaround this, set up your Apache webserver in front of Confluence and redirect requests to this URL.

Related Topics

67 Comments

  1. Can this be done for a specific group (not anonymous users)?

    1. Not currently, but if http://jira.atlassian.com/browse/CONF-8539 was implemented it would be easier for plugin developers to provide more flexible versions of the People Directory.

  2. I'm running this on windows, where do these commands go exactly?

    1. Hi Mark,

      If you are running a Confluence standalone edition, this can be done by editing the setenv.bat file which is available in the ${catalina.home}/bin directory.
      You may be interested to look at the documentation as outlined here as a reference on how to add the additional parameter to the setenv.bat file.

      Hope the information helps.

      Cheers,
      Tony

      1. OK, so I added the line to my Setenv.bat file so that the command line now looks like this:

        set JAVA_OPTS=%JAVA_OPTS% -Xms256m -Xmx1024m -Dconfluence.disable.peopledirectory.anonymous=true
        (Line has wrapped.  The above is all one line.)

        However, the people directory is still alive and well for anonymous.

        I also removed any links I could find related to people directory in the decorators/global.vmd file but the people directory is still available on the dashboard.

        Can anybody tell me what I am doing wrong?

        Thanks,

        Carl

        1. Hi Carl,

          Could you please raise a support request in the following Issue tracker so that we can further investigate the problem from there:

          Regards,
          Choy Li

  3. This setting does not hide nor disable the People Directory!

    It simply prevents anonymous users from browsing the directory. But they can still access all the user profiles, if they somehow find or guess the link to them.

    The dashboard itself lists links to recently updated user profiles, another option is using Google.

    1. hi ulrich,

      do you have a solution for hiding the recently updated links for the user profiles?

      regards

      1. I don't think this is possible.

        What you can do is create a Custom Dashboard. On this dashboard, you can exclude the user profiles from the recently updates list. So you will not see them by default.

        The weird thing is, when you "hide" the peoples directory as described here, and then try to access the peoples directory, it will link you directly to the original dashboard and show up all the recently updated user profiles. (sad)

        In addition, you can prevent search engine indexing on your site.

        Ulrich

  4. Forgive me as someone relatively new to Confluence, but this seems a very clunky of disabling a feature that shouldn't be enabled (to anonymous users) anyway. The default should have the People Directory hidden - surely?

    At the very least I would have anticipated being able to set permissions on this area via the UI not have to do it via a command line. Please can this be included as a change request? 

    1. Hi Peter,

      People Directory provides a list of all users in your Confluence system. Disabling the People Directory can avoid anonymous user accesses through the company's people directory. Additionally, it can be totally disabled to avoid any users access it. Therefore, user can have the options to hide/disable it.

      At the very least I would have anticipated being able to set permissions on this area via the UI not have to do it via a command line. Please can this be included as a change request?

      I would suggest you to raise an improvement request at our issue tracker. Thanks.

      Regards,
      MG

    2. Anonymous

      I totally agree to the above remark. That is very strange than in such an expensive commercial product we see suggestions to use command line, comment piece of code or even "unjar" and edit files. This should have been obvious to any developer without even saying that feature like this has to be configurable from user interface and it should be available before you realease the software.

  5. In Confluence 2.7.2, editing the global.vmd file in standalone confluence (//confluence/decorators/) does not remove the link to the people directory from the front page.  I have even deleted the entire stanza instead of just commenting it out and it's still there.  Any idea where confluence is still picking this up?  I've stopped and restarted multiple times.

    1. Hi Tom,

      I would suggest you to raise a support ticket at our issue tracker for further investigation to this issue:

      Regards,
      MG

    2. Hi Tom,

      I ran into this once. My problem was that I had defined a customized Layout under:

      Dashboard > Administration > Look and Feel > Edit Site Layouts: Global Layout

      BR,
      Klaas.

      1. Hi guys,

        To my understanding, modification made to the Global Layout via the Administration console as well as the global.vmd file available in /decorators directory would take effect if the Confluence instance is configured to use the "Default Theme". If other themes is used instead, you would have to modify the global layout files that relates to the specific theme.
        If the "Default Theme" is used and the modification does not take effect, feel free to raise a support request to reflect the problem that you are seeing.

        Cheers,
        Tony

  6. We are running Confluence 2.7. The people directory was showing without any issues. We have not identified any changes in the configuration but now the people directory is not showing anymore. To be precise, only two users are now showing and the rest are hidden. Any hints how to go back to the previous configuration? We just want all users to appear in the People Directory.... Thanks.

    1. Hi David,

      Please create a support ticket at the following issue tracker and we will verify the problem from there:

      Regards,
      Choy Li

  7. Anonymous

    The profiles still show in the "Recently Updated" list in the dashboard whenever they are modified/created. To hide them, you need to change the following line in decorators/global.vmd:

                             $helper.renderConfluenceMacro("

    ")

    and add some filter that takes them out. I've found "space=*" to work for that.

    Of course if you're using any theme other than the default, you'll need to do that change inside the corresponding .jar file, which is painful but doable.

    Salut,

    Jordi. 

  8. Tip for removing the People Directory from the Confluence Classic theme:

    You need to extract <Confluence Home>bundled-plugins/confluence-classic-theme-2.0.jar, edit the global.vmd in that file, repackaged and redploy.

    You also need to delete/move atlassian-bundled-plugins.zip in <Confluence install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup as otherwise Confluence will re-deploy the original version at every startup and overwrite the changes you made to confluence-classic-theme-2.0.jar.

    Thanks to Atlassian support for the help.

  9. This does not work, I have also tried it set this up for the windows service and it still does not disable the people directory. Although I can hide the people directory in my custom theme plugin, and alter the recently updated call on the dashboard but still people can reference http://dommain.com:8080/peopledirectory.action and view the directory and search across it. I suggest please kindly remove these instructions from the help files since it wastes peoples time without getting anything out of it.

    I am going to remove the peopledirectory.action and browsepeople.action by using conveyor library and put a place holder message there.

    1. Hi,

      Appending the following parameter on your setenv.bat, should disable browse browsepeople.action or peopledirectory.action. I have tried this on several Confluence version, especially in Confluence 2.9.2. If you want to go to Confluence source, you need to disable (comment out) the following things:

      1. Confluence action about peopledirectory.action or browsepeople.action.
      2. disable the webitem about people directory in dashboard or you hide it in your custom theme. Thus, when people access directly to the actions, there is no exception displayed.

      Cheers,

  10. Anonymous

    Hi,

    when we click people directory link is their is any option available to sort out the people in alphabetical order?

    Thanks

    1. Hi there,

      For Confluence 2.10, the People Directory is displayed in alphabetical order and this is not configurable.

      Best regards,

      Giles Gaskell
      Technical Writer
      ggaskell@atlassian.com
      ATLASSIAN - http://www.atlassian.com

  11. In some cases it may be required to rebuild the war file after making this change.

  12. I've successfully removed the People Directory from the Dashboard and the Browse menu, and have disabled for all users, but a link is still showing in the breadcrumb at the top of the screen - anyone know if this can be removed?

    1. Just a thought.... You remove the word "People" (hence the link) in the breadcrumb via ConfluenceActionSupport.properties. It would look like this: Dashboard > > PersonalSpaceName > PageTitle

      1. Thanks Nga.  Probably me being stupid, but where is ConfluenceActionSupport.properties?  Running a search on our filesystem I can't find it.  Is it wrapped in a JAR somewhere?

        1. Andrew, I'm using Confluence 2.8.2, so the file is wrapped inside confluence-2.8.2.jar. $confluenceRoot/confluence/WEB-INF/lib. Once you unzip the jar, it's in this directory: ./com/atlassian/confluence/core

  13. Hi everybody,

    The procedure dont make mention to "how do hide the link "People directory" from the Dashboard.

    I just found that this is possible by adding the "global-dashboard-actions.xml" to the plugin directory also.

    Of course, before doing this, you have to comment from line 31 to 40...

    Sincerly,

    Michael

    1. Yes, it seems that it will overwrite the existing xml file which is bundled in the jar file. Thanks for the sharing

  14. Hope I did not jump the gun - but I have raised a bug regarding the disabling of the People Directory.

    When the 'People Directory' has been disabled, any redirects to the the dashboard (e.g. by clicking on the 'People' link within the breadcrumbs when viewing a profile) result in the dashboard being displayed with the default site welcome message. This occurs even in the case where a custom site welcome message has been specified.

  15. What I'd really like to do is keep the people directory, but hide people that don't belong to the logged-in user's group(s).

    Is this possible?  Any ideas on where to start?

    Thanks!

    -Bridget

    1. Hi,

      You need to modify 1 class file in Confluence so that your query can be fulfilled. The class file is a condition of the people directory appearance. If you use confluence 2.8.x. You just need to update the global.vmd, as Confluence 2.10.x has moved most of the links to be web-item plugins, then you need to change the class. The class which responsible to do this is com.atlassian.confluence.plugin.descriptor.web.conditions.PeopleDirectoryEnabledCondition.

      Cheers,

      1. Hi Arie,

        These changes would only show the other users that belong to the logged-in user's group(s), right? So if there are users that don't belong to the same groups as User A then they won't show up when User A navigates to the People Directory?

        I use confluence 3.0.x, would the changes there be the same as confluence 2.8.x? Exactly what steps do I have to follow? Is the class you mention the new one or the one I'd be replacing. Do I have to rebuild after making the changes?

        Thanks,
        Bridget

        1. Hi Bridget

          Were you able to implement this?

          We have exactly the same issue for a Confluence extranet solution. Users should only be able to see information of their group members and not the whole people directory.

          1. Nope, I didn't wind up trying since no one answered the questions I had. If you try, please let us know how it goes (and good luck)!

            Thanks,
            Bridget

  16. Hi

    Would it be possible to list the possible impacts when someone decides to disable the people directory entirely? We have done this in our company, however now we are finding things like whenever names are shown for e.g. in Space watchers from Space Admin, or in the Forums where the topic authors name shows up, their images do not show. We were wondering if this is a problem because our people directory has been disabled entirely. Please advise

    Thanks

    Lumina

  17. Anonymous

    Hi,

    I would like to know if I can apply a custom Layout ( like a Theme Builder Layout) to the People Directory page or to the Seach page ?

    Also any kind of customization for those pages would be great.

    Thank you

    1. Anonymous

      Yes, you can. Check out:

      Builder should expose the necessary info in the page source.

  18. If you're willing to write a plugin, you can reroute the People Directory to another location by using the Conveyor Plugin to 'override' the existing actions. Instructions are here.

  19. To redirect the URL <CONFLUENCE_INSTALL>/browsepeople.action and avoid to access to People link on breadcrumbs (Dashboard >> People >> FullName >> Profile) do the following:

    1. Open the file <CONFLUENCE_INSTALL>/confluence/WEB-INF/web.xml
    2. Find the following configuration:
    3. Modify it as below:
    4. Then open the file <CONFLUENCE_INSTALL>/confluence/WEB-INF/urlrewrite.xml
    5. Add the following rule:
    6. When you click on "People" link you'll be redirected to Dashboard
  20. Anonymous

    I put my users into groups, and I would like to restrict user visibility by group. For example, if I have a groups ClientA and ClientB, I would like to be sure that members of ClientA cannot see users in group ClientB.

    1. There's an existing feature request for this, see: CONF-7837.

      1. I did not get the idea from this thread. Anyways, does this apply for the latest version of confluence?

  21. I was looking for a good way to disable the people directory when I figured this out.  Simply edit the <Confluence install directory>\confluence\users\peopledirectory-results.vm file.  I just changed it to:

    peopledirectory-results.vm

    You can still click on specific users and get to their user pages.  And of course, the autotext in the search box will reveal user names.  But at least the directory is gone...

    1. Hi Jason,

      Thanks for posting this! Now that the People Directory has been gracefully "disabled", I want to hide users from Search as well.  What I'm hoping to avoid is User A finding out that User B has an account.  In order to really hide User B from User A and vice versa, I'll need to ensure that one user can't do a search for the other.

      How can I ensure that users are not able to search for each other?

      1. I spent a bunch of time trying to solve this problem and I still haven't been able to get a 100% perfect solution.  But having said that, I've had reasonably good results by modifying the search-results.vmd file to filter out user profiles from the results.  See the snippet below:

        <div id="search-results-body">
        <ul class="search-results">
         
        #foreach($searchResult in $results)
           #if ($searchResult.type != "userinfo")
              <li >
                  $action.newSearchResult($searchResult, $showExcerpts, $queryString)
              </li>
           #end
        #end
        </ul>
        </div>

        I also disabled Quick Navigation in the admin->general configuration page.  Even if the users get the name EXACTLY right in the search bar, they still won't get the link in the search results, so this seemed pretty strong.    Bad news though... disabling the quick nav only seems to work on the main search box.  If one of your users clicks the "Share" button at the top of the page and starts typing in the email/user input field, quick nav will "helpfully" suggest users - revealing the very people you were trying to hide.

        I thought about voting for a feature request to Atlassian to add a way to hide users. From what I've seen though, people have been asking for this capability since at least 2006.  Despite numerous requests, Atlassian doesn't seem interested in implementing this feature.  I really respect their policy of encouraging an open culture, and I really wish I could follow their example.  But I'm contractually bound in some cases not to reveal my customers' names, so I don't have that choice.  Instead, I have to resort to modifying a bunch of files to try to hack it out - and if I ever do an upgrade, I'm going to have to be very careful to preserve my changes. 

        I love the product and the support people have all worked really hard to help me, but the inability to fully protect my users' privacy has been a really disappointing aspect of Confluence.

        Jason

        1. Thanks for the help!

          I'm also under strict marching orders to hide users from each other.  

          I often feel that maybe we're just using Confluence in a way it wasn't intended which is why I keep running into these types of difficult issues.  It handles so much of what we want, but there are a lot of little things that start to add up.

        2. Hi again, I'm having a hard time locating search-results.vmd.  Is it in a JAR file?

          1. I have it in: \Program Files\Atlassian\Confluence\confluence\decorators\components

            FYI - I am running version 4.0.

    2. LL

      Thank you!  This is the one solution that worked.  I created a new peopledirectory-results.vm file with your write-up and it's a great solution.  The Atlassian posted solution does not work at all.

  22. Totally agree that a working solution is needed.  The current workarounds do not really disable it, it just makes it slightly more difficult to see.  I'd be happy if we could just make permissions-based access to it (and while we're at it, let's stop showing profiles of disabled accounts in the directory).

  23. This is how my setenv.bat file is like and the "People Dir" keeps showing up. This solution does not work.

    {

    set JAVA_OPTS=%JAVA_OPTS% -Xms256m -Xmx512m -XX:MaxPermSize=256m -Dconfluence.disable.peopledirectory.all=true

    rem Checks if the JAVA_HOME has a space in it (can cause issues)
    SET _marker=%JAVA_HOME: =%
    IF NOT "%_marker%" == "%JAVA_HOME%" ECHO JAVA_HOME "%JAVA_HOME%" contains spaces. Please change to a location without spaces if this causes problems.

    echo If you encounter issues starting up Confluence Standalone, please see the Installation guide at Confluence Installation Guide
    SET "JRE_HOME=C:\Program Files\Atlassian\Confluence\jre"

    }

  24. Anonymous

    This is really needed, profile information and status needn't be public for all to see. This is after I have disabled the people directory which is a pointless exercise from a security point of view.

     

  25. Yes, this is something really, really needed.  For those of use using Confluence as a multi-customer extranet this is a must have feature.  We've about got it there though through a combination of hints from this page and other changes:

    1. "Turn off" the people directory in the confluence startup files
    2. Stefano's approach to filtering Tomcat URLs to actually make #1 work.
    3. Jason's search result filter code
    4. Disabling quick search in the Global options
    5. Disabling the "Share" plugin
    6. Disabling much of the Profile plugin (network and network macro js resources) to make the Network boxes not work
    7. Adding a User Macro with the name "network" to display "Network feature is disabled" to stop errors from showing up on the page
    8. And kind of related... we removed the right half of the Dashboard page to keep global updates from being shown to normal users (spaces tend to have "per space" update lists in them).

    Whew.  Quite a lot of work, just to do something that should really be a built-in feature.

     

    1. Paul, which version of Confluence did you implement these steps in?

  26. Quite handy for anonymous to see the people.
    Now you can see all the suers of atlassian (big grin)

    https://confluence.atlassian.com/browsepeople.action?startIndex=

    Seriously? Anonymous should NOT see this!

  27. Anonymous

    So, the Atlassian Confluence system is a perfect source for

    • email spammers
    • head hunters
    • Competition Analysis
    • advocats (which want to make money by setting up a class case against Atlassian)

     

  28. So, this is still "state-of-the-art"??

    At least a "can view user list" permission might be implemented easily, does it?

    Thx for considering!

  29. Hi friends! =)

    Is it good way to hide People directory by pasting

    #people-directory-link{display: none}

    In the "At end of the HEAD" section in Custom HTML?

    I mean 5.5.2 version.

     

  30. ATLASSIAN, 7 years!!! Fix this properly (disable user directory and SEARCH AUTOCOMPLETE), it's a security vulnerability! 

     

  31. When will there be a similar feature for the Cloud version?  Currently, we cannot grant access to some external users, as they can view the names and email addresses of other users.

  32. Just ran into this too (Cloud version), client is telling one of the project managers he can see all other clients. Not happy with this.

    I did manage to hide the email addresses, but making this is 'feature' is just a bad thing. Wouldn't it be a better option to just show the user directory to specific groups, for instance developers?

    We need your voice here, Atlassian.

    1. Hi Arjan,

      Not sure if you have already, but it would be good to watch the below issue and add a comment to let people know you're looking for this functionality.

      CONF-7837 - People Directory and "controlled" privacy / configure access to People Directory depending on Group membership Open

  33. Why are so simple things are always so complicated?

    Why not simply add it into Admin config menu like 

    • enable People Directory
    • enable Help Menu
    • etc